Add support for policies in buf.lock

[emcfarlane]

This PR adds support for policies in the buf.lock file. The lock file includes a new field policies which declares a set of policies and their plugin keys. This is a hierarchical structure. A policy's remote plugins are versioned independently from other policies and the current lint/breaking plugin configuration. A local policy, defined by a path to a policy yaml file, may include remote plugins. This policy is stored as the name, without a commit or digest. A remote poilcy, defined by the BSR name, must have a name and digest.

As an example buf.lock supports the following:

version: v2
policies:
  # A locally defined policy file with remote plugins
  - name: buf.policy.yaml
    plugins:
      - name: buf.build/acme/plugin
        commit: ffded0b4cf6b47cab74da08d291a3c2f
        digest: p1:24ed4f13925cf89ea0ae0127fa28540704c7ae14750af027270221b737a1ce658f8014ca2555f6f7fcd95ea84e071d33f37f86cc36d07fe0d0963329a5ec2462
  # A remote policy with plugins.
  - name: buf.build/acme/policy
    commit: ffded0b4cf6b47cab74da08d291a3c2f
    digest: o1:24ed4f13925cf89ea0ae0127fa28540704c7ae14750af027270221b737a1ce658f8014ca2555f6f7fcd95ea84e071d33f37f86cc36d07fe0d0963329a5ec2462
    plugins:
      - name: buf.build/acme/plugin
        commit: ffded0b4cf6b47cab74da08d291a3c2f
        digest: p1:24ed4f13925cf89ea0ae0127fa28540704c7ae14750af027270221b737a1ce658f8014ca2555f6f7fcd95ea84e071d33f37f86cc36d07fe0d0963329a5ec2462

[github-actions[bot]]

The latest Buf updates on your PR. Results from workflow Buf CI / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Jul 18, 2025, 12:07 PM